Horos 2.1.0 DICOM Medical Image Viewer Remote Memory Overflow Vulnerability

Title: Horos 2.1.0 DICOM Medical Image Viewer Remote Memory Overflow Vulnerability
Advisory ID: ZSL-2016-5386
Type: Local/Remote
Impact: System Access, DoS
Risk: (4/5)
Release Date: 16.12.2016
Horos™ is an open-source, free medical image viewer. The goal of the Horos Project is to develop a fully functional, 64-bit medical image viewer for OS X. Horos is based upon OsiriX and other open source medical imaging libraries.
The vulnerability is caused due to the usage of vulnerable collection of libraries that are part of DCMTK Toolkit, specifically the parser for the DICOM Upper Layer Protocol or DUL. Stack/Heap Buffer overflow/underflow can be triggered when sending and processing wrong length of ACSE data structure received over the network by the DICOM Store-SCP service. An attacker can overflow the stack and the heap of the process when sending large array of bytes to the presentation context item length segment of the DICOM standard, potentially resulting in remote code execution and/or denial of service scenario.
Horos Project - https://www.horosproject.org
Affected Version
Tested On
macOS 12.10.2 (Sierra)
macOS 12.10.1 (Sierra)
Vendor Status
[15.12.2016] Vendor informed.
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>
[1] https://www.exploit-db.com/exploits/40929/
[2] https://packetstormsecurity.com/files/140193
[3] https://cxsecurity.com/issue/WLB-2016120104
[4] http://www.vfocus.net/art/20161219/13215.html
[5] https://exchange.xforce.ibmcloud.com/vulnerabilities/119842
[16.12.2016] - Initial release
[20.12.2016] - Added reference [1], [2], [3] and [4]
[24.12.2016] - Added reference [5]
Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk